feat: gate sidebar chat behind --chat flag

$B connect (default): headed Chromium + extension with Activity + Refs
tabs only. No separate agent spawned. Clean, no confusion.

$B connect --chat: same + Chat tab with standalone claude -p agent.
Shows experimental banner: "Standalone mode — this is a separate
agent from your workspace."

Implementation:
- cli.ts: parse --chat, set BROWSE_SIDEBAR_CHAT env, conditionally
  spawn sidebar-agent
- server.ts: gate /sidebar-* routes behind chatEnabled, return 403
  when disabled, include chatEnabled in /health response
- sidepanel.js: applyChatEnabled() hides/shows Chat tab + banner
- background.js: forward chatEnabled from health response
- sidepanel.html/css: experimental banner with amber styling

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

extension/background.js

@@ -46,7 +46,8 @@ async function checkHealth() {
     if (data.status === 'healthy') {
       // Capture auth token from health response
       if (data.token) authToken = data.token;
-      setConnected(data);
+      // Forward chatEnabled so sidepanel can show/hide chat tab
+      setConnected({ ...data, chatEnabled: !!data.chatEnabled });
     } else {
       setDisconnected();
     }